Privacy and Porn on Workplace Computers

Employees have a reasonable expectation of privacy in the personal information on their workplace computers, even if that expectation can be significantly diminished with effective workplace policies and practices. However, whether such reasonable expectations extend to workplace computer evidence admitted in a criminal proceeding was addressed in last Friday’s highly anticipated Supreme Court of Canada decision of R v Cole.

In that case, a school board computer technician ran a routine system maintenance check on the computer network and he discovered photographs of a naked student on a teacher’s laptop. The technician advised the school principal. On the principal’s instructions, the technician copied the photos to a disc, obtained the computer and copied the temporary internet files onto a second disc. The laptop and both discs were then handed over to the police.

Workplace Computer Evidence Wrongly Excluded at Criminal Trial

The police reviewed the evidence, and charged Mr. Cole with possession of child pornography and unauthorized use of a computer. At trial, all of the evidence was thrown out, because the police had obtained the laptop and discs without a search warrant. At the heart of this case is whether an employee has any expectation of privacy of information on a workplace computer, which may attract Charter rights to prevent such evidence from being gathered and used against the employee in a legal proceeding.

The Supreme Court of Canada held that while Mr. Cole’s Charter right to be free from unreasonable state search and seizure had been breached, the admission of that evidence was appropriate in the circumstance and would not bring the administration of justice into disrepute.

Accordingly, the Court ordered a new trial, ordering that the evidence unlawfully obtained by the police should not be excluded in this case.

Reasonable Expectations of Privacy

Although this is a criminal law case, there are a number of employment law aspects to the matter.

First, while Canadians may reasonably expect privacy in the information found on our home computers, this decision reiterates the principle that information on work-issued computers does attract some reasonable expectation of privacy. Computers typically contain information that is “meaningful, intimate, and touching on the user’s biographical core”, attracting a protection of privacy.

Second, while workplace policies and practices may diminish an employee’s expectation of privacy, such “operational realities” around workplace policies and practices do not remove the expectation entirely. Context will matter.

Third, in this case, the employer was entitled to rely on the evidence it obtained through a standard, workplace maintenance check to discipline the employee as appropriate through its internal procedures. The school board was not, however, entitled to waive the employee’s Charter rights by handing over such evidence to the police, even if the employer had originally lawfully obtained such evidence for own human resource purposes. Only the employee could consent to disclosing the private information to the state.

Take-Away for Employers

Workplace policies are a critical tool for employers to enforce workplace standards, but they cannot be left to gather dust on an electronic shelf. In this case, the Court relied on several facts to lessen the employee’s expectation of privacy in the workplace:

the workplace policy was up to date, asserting ownership of both the hardware and the data;

the employer annually reminded the employees that the students’ computer use policy also applied to the employees; and

the student policy specifically provided that email could be monitored and that users should not assume that any files stored on the network servers or hard drives of individual employer-issued computers will be private.

All of these factors diminished Mr. Cole’s expectation of privacy, but did not eliminate it. He was entitled to be free from unreasonable state search and seizure of such personal information.

Employers should not only continue to ensure their computer use, privacy, social media and electronic data policies are up to date, but it is essential that employees are informed and educated about the meaning and impact of such workplace policies so that employers can more effectively rely on such policies and practices.